Security architecture
Verified against the production host; see the full audit trail in the repository's SECURITY.md. Status as of September 2026.
Hosting & residency
Isolated compose stack (frontend, backend, Directus, Postgres) on a single host in Frankfurt am Main, Germany (EU). No US or third-country transfer in the default path; the external AI provider slot is allow-listed to EU/EEA/UK.
Encryption in transit
Automatic HTTPS via Caddy (Let's Encrypt, auto-renewed), TLS 1.3 negotiated, legacy TLS rejected. The API listens on loopback only behind the proxy; HSTS plus nosniff, no-framing, and strict-referrer headers on every response.
Identity & access
Directus Auth is the identity provider (argon2 password hashing — the scan backend never sees passwords). Short-lived 15-minute HS256 access tokens with refresh rotation; Agency workspaces separate admin and member roles.
Content handling
Uploads are memory-only — raw bytes never touch disk. Only scan metadata (score, indicators, rule) is stored, capped and purged after 30 days. Account deletion purges content immediately with a 90-day retention record.
Abuse prevention
Per-IP rate limits (120/min global, 60/min scans, 30/min auth and billing), monthly scan quotas per plan, 10 MB / 50-megapixel upload guards, and magic-byte validation on every file. Malware scanning hooks in via ClamAV where configured.
Responsible disclosure
Found a vulnerability? Write to hello@xentavi.com — we respond within two business days.